Rate Limiting Guidance

Pushpay uses a tiered system of rate limits to ensure that no single API client can cause detrimental performance to the Pushpay platform.

How Rate Limits Are Applied

Limits are enforced in tiers, to allow for bursts of activity.
Limits are applied at the Client ID and Organization level — so if two different Pushpay Organizations have authorized access to different sets of data, their two issued refresh tokens/access tokens will not share the same rate limit.

Current Rate Limits

Window	Limit
Per second	10 requests
Per minute	60 requests
Per hour	500 requests
Per day	5,000 requests
Per week	10,000 requests

If you have concerns that your application will need to exceed these limits, please contact [email protected] so we can discuss your needs and work together on a suitable solution.

Handling a 429 Response

When a rate limit is hit, the Pushpay API returns a 429 Too Many Requests status code. This response includes:

A body with information about the limit, e.g.:

"API calls quota exceeded! Maximum admitted 10 per Second."
A retry-after header value indicating the number of seconds to wait before attempting another request.

Recommended Retry Strategy

We recommend using the retry-after value combined with an incremental back-off mechanism:

On your first 429 response, wait retry-after + 1 second before retrying.
If that retry also fails, wait retry-after + 2 seconds before retrying again.
For subsequent retries, back off exponentially — e.g. retry-after + 4, retry-after + 8, retry-after + 16 seconds, and so on.

Tip: Adding a small amount of random delay (jitter) on top of this schedule helps prevent multiple concurrent retries from all landing at the same time.